Android one-tap installs expand to approved app stores
Android one-tap installs will become available through approved third-party app stores from December 1, reducing the confirmation screens users encounter when installing and updating apps outside Google Play. Participating stores will also be able to update apps in the background, but only on devices running Android 17 QPR2 or later in supported countries. The United States is not included.
Under Android's current process, a user must first allow a third-party store to install apps and then approve every installation and update. A store accepted into Google's Registered App Stores program will receive installation permission automatically after approval. Its updates can then run in the background according to the user's own update settings. Joining the program is optional, so stores that do not participate can continue operating under the existing process.
The change does not permit silent app installation. Google's rules require registered stores to obtain explicit user consent for each app installed, meaning the user must still choose to proceed. Large downloads and installations running in the background must display a visible notification. If an installation begins on another device, the store must show a notification that remains visible rather than closing automatically.
Approval requires identity verification and continuing access to the store's catalog. An applicant must provide Google with its complete selection of apps, followed by every new app and update, for malware scanning. Malware is software intended to damage devices, steal information or perform other unwanted actions. Google's program pages do not explain how these scans work, how quickly new submissions are processed or what results a store receives.
A participating store must be registered as an organisation and maintain a verified developer identity through Android developer verification. It must also submit every version of its own store app for screening. The submitted copy must exactly match the version distributed on its website and through other channels. Other requirements include working to exclude malware and other potentially harmful apps, addressing major security weaknesses that become known, and not obstructing rival stores or altering Android's security notifications.
Stores must pay a $10,000 annual fee before Google's review begins. Each store remains responsible and legally liable for everything offered through its catalog, while Google will not moderate the catalog's content. If potentially harmful software accounts for more than 1% of installation attempts or more than 2% of the store's apps during a 30-day period, Google will impose additional charges for catalog screening and cleanup. A store that breaches any condition, including missing a payment, can be suspended from the program after receiving notice and an opportunity to correct the problem.
Registered stores will also receive access to the Android Developer ID API. An application programming interface, or API, is a defined way for one piece of software to request information from another. The tool lets stores check whether an app comes from a verified developer and is permitted to be installed. Google recommends blocking installations when an app fails that check.
Android developer verification is a separate program and is currently in its first phase with seven app stores. According to Google, certified Android devices in Brazil, Indonesia, Singapore and Thailand have checked apps from those stores for verified developer identities since September 30. The company plans to expand those checks worldwide in 2027.
Businesses can prevent registered stores from being installed on managed devices, which are phones or tablets controlled through an organisation's IT policies. Google's program information does not clarify whether that restriction will also disable a registered store that is already present. Administrators therefore need to review existing devices as well as policies governing new installations. For organisations deciding how registered stores fit into managed-device policy, AEU-I offers security-first IT, infrastructure and consulting.
Availability will follow the user's home country. Brief travel to a country where the program is unavailable will not disable one-tap installations or automatic updates. Android 17 QPR2 is a quarterly platform release, one of Android's periodic system updates. Its latest version, released October 16, remains in beta, and Google's release notes provide no date for a final release.
Google first announced the registered-store program in March alongside changes it said resolved disputes with Epic Games. A separate arrangement allowing third-party stores to be distributed through Google Play in the United States has operated since July 22. Together, the rules create different distribution paths depending on location, device version and whether a store has completed registration.